Design Studio Java Deserialization RCE via License Server

Critical Vulnerability Information Title Arbitrary Code Execution on MC License Server via Java Deserialization in Design Studio License Authentication by Product User Affected Version - Fix ID - Fixed Version Affected Version: Fix ID: Fixed Version: Phenomenon A DesignStudio product user, using a password, directly transmits a serialized file containing malicious Java code to the Tomcat server's product folder. By invoking the corresponding Java code, arbitrary code execution becomes possible, and this issue has been reported. Conditions for Exploitation The following conditions are required to reproduce the vulnerability: The DesignStudio product user possesses a password HTTP communication from DesignStudio to Tomcat is possible The system is connected to the MC License Server environment Mitigation Measures The primary mitigation is to change the default Tomcat configuration folder path, as DesignStudio users authenticate with passwords and require direct file manipulation on the server. This change can prevent exploitation of the vulnerability. For existing installations, if the password is changed, a reinstallation from the original state is necessary. For new users, please ensure that DesignStudio-side passwords are not used by managing IDs and passwords appropriately. When the vulnerability was reproduced, Windows Defender blocked the file serialization and transmission phase. Therefore, we consider security software inspection as an effective mitigation measure for internal users. If the vulnerability affects non-Tomcat environments (e.g., POC environments) and mitigation is required due to circumstances such as external server validation, please contact your sales representative or our technical support team. Notes Following this report, we have updated the product manual to recommend randomizing the Tomcat installation path. (Product Installation Guide) Reference Information Product Installation Guide Initial Disclosure Date 2025/02/02 17:00 Last Update Date 2025/04/09 3:34 Update History URL Name: 39553373809305

Goal Reached Thanks to every supporter — we hit 100%!

Design Studio Java Deserialization RCE via License Server